The plan must require that the suppliers of the IAC cyber assets in the asset inventory are identified. At the Enhanced Profile and above a supply chain risk assessment process must identify, categorise and rank the cyber risk the supply chain poses to the IAC cyber environment, covering assets and services performed on or within it; consistent categorisation and assessment criteria are set; categorisation includes the impact on essential functions; supply chain risk is handled under the risk management strategy; and it is reassessed at an organisation-defined frequency. At the Extended Profile the reassessment occurs at least every 3 years and never later than 45 months.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.